dotnet / dotnet/vscode-dotnet-runtime

Uninstall runtimes/SDK that are out of support or vulnerable.

Open
#1,823 0 comments 0 reactions 1 assignee Claimed by @nagilson View on GitHub
feature-request
Dominant language
TypeScript
Stars
209
Forks
455
PR merge metrics
No merged PRs in 30d

Description

### Is your feature request related to a problem? Please describe.

Without any kind of change, this extension will install many copies of the .NET Runtime as various extensions request them. In addition, leaving older runtimes around on the system can present a security risk as newer versions of the runtime come with security fixes.

### A clear and concise description of what you want to happen. Include any alternative solutions you've considered.

For SDKs and Runtimes that this extension manages that are out-of-support or have CVEs and have an in-support version already installed, this extension should clean up those older versions.

### Describe the solution you'd like

We should clean up releases that have CVEs listed (see the cve-list property on the [releases manifest](https://dotnetcli.blob.core.windows.net/dotnet/release-metadata/9.0/releases.json)) on a periodic basis. If extensions do need out of support runtimes they should re-request on launch.

Specifically, once per launch of this extension we should check the releases manifest, and if the latest requested runtime is a security release then we need to clean up all previous versions of the requested runtime.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.